fix(GRO-1576): add provenance: false to all build-push-action steps

Docker Buildx v6 defaults to OCI attestation manifests (--attest type=provenance,mode=max). These hit a Gitea registry bug when image layers are pre-existing (blob mount), causing "unknown" errors on manifest list push. API image succeeds because it pushes new layers; migrate/seed/ reset fail because their layers already exist. Disabling provenance attestation on all four build-push-action steps resolves the push failures. Addresses GRO-1575. Co-Authored-By: Paperclip <noreply@paperclip.ing>
Merge pull request 'revert: undo PR #47 Dockerfile apps/api switch (broke CI Docker build)' (#50 ) from revert/gro-1533-dockerfile-fix into dev
2026-05-23 01:30:16 +00:00 · 2026-05-22 13:31:12 +00:00 · 2026-05-22 13:30:51 +00:00 · 2026-05-22 13:23:49 +00:00 · 2026-05-22 13:23:33 +00:00 · 2026-05-22 13:17:09 +00:00
2 changed files with 7 additions and 3 deletions
@@ -93,6 +93,7 @@ jobs:
          file: Dockerfile
          target: runner
          push: true
+          provenance: false
          tags: |
            git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
@@ -106,6 +107,7 @@ jobs:
          file: Dockerfile
          target: migrate
          push: true
+          provenance: false
          tags: |
            git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }}
            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }}
@@ -119,6 +121,7 @@ jobs:
          file: Dockerfile
          target: seed
          push: true
+          provenance: false
          tags: |
            git.farh.net/groombook/seed:${{ steps.version.outputs.tag }}
            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }}
@@ -132,6 +135,7 @@ jobs:
          file: Dockerfile
          target: reset
          push: true
+          provenance: false
          tags: |
            git.farh.net/groombook/reset:${{ steps.version.outputs.tag }}
            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }}
@@ -42,12 +42,12 @@ CMD ["node", "dist/index.js"]

 # Migrate stage — runs drizzle-kit migrate against the database
 FROM builder AS migrate
-CMD ["pnpm", "db:migrate"]
+CMD ["pnpm", "--filter", "@groombook/db", "migrate"]

 # Seed stage — populates the database with test data
 FROM builder AS seed
-CMD ["pnpm", "db:seed"]
+CMD ["pnpm", "--filter", "@groombook/db", "seed"]

 # Reset stage — drops all tables, re-runs migrations, and re-seeds
 FROM builder AS reset
-CMD ["pnpm", "db:reset"]
+CMD ["pnpm", "--filter", "@groombook/db", "reset"]
Author	SHA1	Message	Date
Flea Flicker	e26d960046	fix(GRO-1576): add provenance: false to all build-push-action steps CI / Lint & Typecheck (pull_request) Successful in 11s Details CI / Test (pull_request) Successful in 11s Details CI / Build & Push Docker Images (pull_request) Failing after 2m28s Details Docker Buildx v6 defaults to OCI attestation manifests (--attest type=provenance,mode=max). These hit a Gitea registry bug when image layers are pre-existing (blob mount), causing "unknown" errors on manifest list push. API image succeeds because it pushes new layers; migrate/seed/ reset fail because their layers already exist. Disabling provenance attestation on all four build-push-action steps resolves the push failures. Addresses GRO-1575. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-23 01:30:16 +00:00
The Dogfather	f55c74983f	Merge pull request 'revert: undo PR #47 Dockerfile apps/api switch (broke CI Docker build)' (#50 ) from revert/gro-1533-dockerfile-fix into dev CI / Lint & Typecheck (push) Successful in 9s Details CI / Test (push) Successful in 9s Details CI / Build & Push Docker Images (push) Successful in 50s Details revert: undo PR #47 Dockerfile apps/api switch (broke CI Docker build) Restores root src/ build path. PR #47 broke CI because pnpm-workspace.yaml and lockfile dont include apps/*. Admin 500 root cause is in code/schema changes. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-22 13:31:12 +00:00
Chris Farhood	8bdab69288	revert: undo PR #47 Dockerfile apps/api switch (broke CI Docker build) CI / Test (pull_request) Successful in 8s Details CI / Lint & Typecheck (pull_request) Successful in 9s Details CI / Build & Push Docker Images (pull_request) Successful in 47s Details Reverts the Dockerfile to the root src/ build. PR #47 switched to apps/api/ but the pnpm workspace config and lockfile don't include apps/*, causing Docker build failures (CI runs #968, #970). The actual admin 500 root cause needs further investigation — it's in the code/schema changes, not the Dockerfile build path. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-22 13:30:51 +00:00
The Dogfather	8f7104c3a0	Merge pull request 'fix(GRO-1533): revert Dockerfile to build from apps/api/src/' (#47 ) from fix/gro-1533-revert-dockefile-build-change into dev CI / Test (push) Successful in 9s Details CI / Lint & Typecheck (push) Successful in 10s Details CI / Build & Push Docker Images (push) Failing after 18s Details fix(GRO-1533): revert Dockerfile to build from apps/api/src/ Reverts the Dockerfile change that switched from pnpm --filter @groombook/api build to pnpm build, which caused the image to build from root src/ instead of apps/api/src/. This produced HTTP 500 on all authenticated admin routes. Conflict with PR #45 (seed filter fix) resolved: migrate/seed/reset stages use @groombook/api db:migrate\|seed\|reset since the builder only has apps/api/. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-22 13:23:49 +00:00
Flea Flicker	dab9bfab71	fix(GRO-1533): revert Dockerfile to build from apps/api/src/ CI / Test (pull_request) Successful in 10s Details CI / Lint & Typecheck (pull_request) Successful in 10s Details CI / Build & Push Docker Images (pull_request) Failing after 18s Details The Dockerfile build change (pnpm build → pnpm --filter @groombook/api) was made against dev HEAD, but the root src/ directory was never fully audited for parity with apps/api/src/. Admin routes returning 500 for authenticated users post-OIDC login is consistent with the image running code with incomplete middleware chain or mismatched schema types when the root build path was used. Revert to the apps/api/ build path which is known to work correctly. UAT is running images from dev branch commit `9462915` which includes this change alongside schema cleanup commits. Root cause: Dockerfile was changed to build from root src/ instead of apps/api/src/ without confirming the two source trees are functionally identical. The proper fix path (schema audit + reconciliation) is tracked in GRO-1536. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-22 13:23:33 +00:00
The Dogfather	70bc946a0d	Merge pull request 'fix(seed): use --filter @groombook/db for seed/migrate/reset scripts' (#45 ) from flea-flicker/gro-1531-seed-db-filter into dev CI / Lint & Typecheck (push) Successful in 10s Details CI / Test (push) Successful in 10s Details CI / Build & Push Docker Images (push) Successful in 21s Details fix(seed): use --filter @groombook/db for seed/migrate/reset scripts Merge PR #45 to dev. QA approved (review #3506), CTO reviewed.	2026-05-22 13:17:09 +00:00
Flea Flicker	40422a14f0	fix(seed): use --filter @groombook/db to invoke seed/migrate/reset scripts CI / Lint & Typecheck (pull_request) Successful in 11s Details CI / Test (pull_request) Successful in 11s Details CI / Build & Push Docker Images (pull_request) Successful in 51s Details The seed/migrate/reset Dockerfile targets specified `pnpm db:migrate` etc., but those scripts are defined in packages/db/package.json, not at the workspace root. pnpm workspace filtering is required to route the command to the correct package. - migrate: pnpm --filter @groombook/db migrate - seed: pnpm --filter @groombook/db seed - reset: pnpm --filter @groombook/db reset Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-22 13:08:49 +00:00